Vulnerabilities > CVE-2005-1698 - Forced Browsing vulnerability in Postnuke 0.750/0.760
Attack vector
UNKNOWN Attack complexity
UNKNOWN Privileges required
UNKNOWN Confidentiality impact
UNKNOWN Integrity impact
UNKNOWN Availability impact
UNKNOWN Summary
PostNuke 0.750 and 0.760RC3 allows remote attackers to obtain sensitive information via a direct request to (1) theme.php or (2) Xanthia.php in the Xanthia module, (3) user.php, (4) thelang.php, (5) text.php, (6) html.php, (7) menu.php, (8) finclude.php, or (9) button.php in the pnblocks directory in the Blocks module, (10) config.php in the NS-Multisites (aka Multisites) module, or (11) xmlrpc.php, which reveals the path in an error message.
Vulnerable Configurations
Part | Description | Count |
---|---|---|
Application | 2 |
Common Weakness Enumeration (CWE)
Common Attack Pattern Enumeration and Classification (CAPEC)
- Directory Indexing An adversary crafts a request to a target that results in the target listing/indexing the content of a directory as output. One common method of triggering directory contents as output is to construct a request containing a path that terminates in a directory name rather than a file name since many applications are configured to provide a list of the directory's contents when such a request is received. An adversary can use this to explore the directory tree on a target as well as learn the names of files. This can often end up revealing test files, backup files, temporary files, hidden files, configuration files, user accounts, script contents, as well as naming conventions, all of which can be used by an attacker to mount additional attacks.
- Forceful Browsing An attacker employs forceful browsing to access portions of a website that are otherwise unreachable through direct URL entry. Usually, a front controller or similar design pattern is employed to protect access to portions of a web application. Forceful browsing enables an attacker to access information, perform privileged operations and otherwise reach sections of the web application that have been improperly protected.
Nessus
NASL family CGI abuses NASL id POSTNUKE_0_760_RC3.NASL description The remote host is running PostNuke version 0.760 RC4a or older. These versions suffer from several vulnerabilities, among them : - Multiple Remote Code Injection Vulnerabilities An attacker can read arbitrary files on the remote and possibly inject arbitrary PHP code remotely. - SQL Injection Vulnerabilities Weaknesses in the last seen 2020-06-01 modified 2020-06-02 plugin id 18360 published 2005-05-23 reporter This script is Copyright (C) 2005-2018 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/18360 title PostNuke <= 0.760 RC4a Multiple Vulnerabilities code # # (C) Tenable Network Security, Inc. # include("compat.inc"); if (description) { script_id(18360); script_version("1.22"); script_cve_id("CVE-2005-1621", "CVE-2005-1697", "CVE-2005-1698", "CVE-2005-1699", "CVE-2005-1700"); script_bugtraq_id(13706, 13789); script_name(english:"PostNuke <= 0.760 RC4a Multiple Vulnerabilities"); script_set_attribute(attribute:"synopsis", value: "The remote web server contains a PHP script that is prone to several attacks." ); script_set_attribute(attribute:"description", value: "The remote host is running PostNuke version 0.760 RC4a or older. These versions suffer from several vulnerabilities, among them : - Multiple Remote Code Injection Vulnerabilities An attacker can read arbitrary files on the remote and possibly inject arbitrary PHP code remotely. - SQL Injection Vulnerabilities Weaknesses in the 'Xanthia' and 'Messages' modules allow attackers to affect database queries, possibly resulting in the disclosure of sensitive information such as user passwords and even execution of arbitrary PHP code on the remote host. - Multiple Cross-Site Scripting Vulnerabilities An attacker can inject arbitrary script code into the browser of users leading to disclosure of session cookies, redirection to other sites, etc. - Multiple Path Disclosure Vulnerabilities An attacker can discover details about the underlying installation directory structure by calling various include scripts directly." ); script_set_attribute(attribute:"see_also", value:"https://seclists.org/bugtraq/2005/May/196" ); script_set_attribute(attribute:"see_also", value:"https://seclists.org/bugtraq/2005/May/253" ); script_set_attribute(attribute:"see_also", value:"https://seclists.org/bugtraq/2005/May/254" ); script_set_attribute(attribute:"see_also", value:"https://seclists.org/bugtraq/2005/May/255" ); script_set_attribute(attribute:"see_also", value:"http://community.postnuke.com/Article2691.htm" ); script_set_attribute(attribute:"solution", value: "Apply the security fix package referenced in the article above to upgrade to PostNuke version 0.750.0b." ); script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P"); script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C"); script_set_attribute(attribute:"exploitability_ease", value:"No exploit is required"); script_set_attribute(attribute:"exploit_available", value:"false"); script_set_attribute(attribute:"plugin_publication_date", value: "2005/05/23"); script_set_attribute(attribute:"vuln_publication_date", value: "2005/05/16"); script_cvs_date("Date: 2018/11/15 20:50:18"); script_set_attribute(attribute:"plugin_type", value:"remote"); script_set_attribute(attribute:"cpe", value:"cpe:/a:postnuke_software_foundation:postnuke"); script_end_attributes(); script_summary(english:"Detects multiple vulnerabilities in PostNuke <= 0.760 RC4a"); script_category(ACT_ATTACK); script_family(english:"CGI abuses"); script_copyright(english:"This script is Copyright (C) 2005-2018 and is owned by Tenable, Inc. or an Affiliate thereof."); script_dependencies("postnuke_detect.nasl"); script_exclude_keys("Settings/disable_cgi_scanning"); script_require_ports("Services/www", 80); script_require_keys("www/PHP"); exit(0); } include("global_settings.inc"); include("misc_func.inc"); include("http.inc"); port = get_http_port(default:80); if (!can_host_php(port:port))exit(0); # Test an install. install = get_kb_item(string("www/", port, "/postnuke")); if (isnull(install)) exit(0); matches = eregmatch(string:install, pattern:"^(.+) under (/.*)$"); if (!isnull(matches)) { dir = matches[2]; test_cgi_xss(port: port, cgi: "/index.php", pass_re: "root:.+:0:", high_risk: 1, sql_injection: 1, qs: string( "module=Blocks&", "type=lang&", "func=../../../../../../../../../../../../etc/passwd%00" ) ); }
NASL family FreeBSD Local Security Checks NASL id FREEBSD_PKG_0274A9F1075911DABC080001020EED82.NASL description Postnuke Security Announcementss reports of the following vulnerabilities : - missing input validation within /modules/Messages/readpmsg.php - possible path disclosure within /user.php - possible path disclosure within /modules/News/article.php - possible remote code injection within /includes/pnMod.php - possible cross-site-scripting in /index.php - remote code injection via xml rpc library last seen 2020-06-01 modified 2020-06-02 plugin id 21379 published 2006-05-13 reporter This script is Copyright (C) 2006-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/21379 title FreeBSD : postnuke -- multiple vulnerabilities (0274a9f1-0759-11da-bc08-0001020eed82) code #%NASL_MIN_LEVEL 80502 # # (C) Tenable Network Security, Inc. # # The descriptive text and package checks in this plugin were # extracted from the FreeBSD VuXML database : # # Copyright 2003-2018 Jacques Vidrine and contributors # # Redistribution and use in source (VuXML) and 'compiled' forms (SGML, # HTML, PDF, PostScript, RTF and so forth) with or without modification, # are permitted provided that the following conditions are met: # 1. Redistributions of source code (VuXML) must retain the above # copyright notice, this list of conditions and the following # disclaimer as the first lines of this file unmodified. # 2. Redistributions in compiled form (transformed to other DTDs, # published online in any format, converted to PDF, PostScript, # RTF and other formats) must reproduce the above copyright # notice, this list of conditions and the following disclaimer # in the documentation and/or other materials provided with the # distribution. # # THIS DOCUMENTATION IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS "AS IS" # AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, # THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR # PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS # BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, # OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT # OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR # BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, # WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE # OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS DOCUMENTATION, # EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. # include("compat.inc"); if (description) { script_id(21379); script_version("1.18"); script_cvs_date("Date: 2019/08/02 13:32:36"); script_cve_id("CVE-2005-1621", "CVE-2005-1695", "CVE-2005-1696", "CVE-2005-1698", "CVE-2005-1777", "CVE-2005-1778", "CVE-2005-1921"); script_xref(name:"Secunia", value:"15450"); script_name(english:"FreeBSD : postnuke -- multiple vulnerabilities (0274a9f1-0759-11da-bc08-0001020eed82)"); script_summary(english:"Checks for updated package in pkg_info output"); script_set_attribute( attribute:"synopsis", value:"The remote FreeBSD host is missing a security-related update." ); script_set_attribute( attribute:"description", value: "Postnuke Security Announcementss reports of the following vulnerabilities : - missing input validation within /modules/Messages/readpmsg.php - possible path disclosure within /user.php - possible path disclosure within /modules/News/article.php - possible remote code injection within /includes/pnMod.php - possible cross-site-scripting in /index.php - remote code injection via xml rpc library" ); # http://marc.theaimsgroup.com/?l=bugtraq&m=111721364707520 script_set_attribute( attribute:"see_also", value:"https://marc.info/?l=bugtraq&m=111721364707520" ); # http://news.postnuke.com/Article2691.html script_set_attribute( attribute:"see_also", value:"http://www.postnuke.com/Article2691.html" ); # http://news.postnuke.com/Article2699.html script_set_attribute( attribute:"see_also", value:"http://www.postnuke.com/Article2699.html" ); # https://vuxml.freebsd.org/freebsd/0274a9f1-0759-11da-bc08-0001020eed82.html script_set_attribute( attribute:"see_also", value:"http://www.nessus.org/u?4d778378" ); script_set_attribute(attribute:"solution", value:"Update the affected package."); script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P"); script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available"); script_set_attribute(attribute:"exploit_available", value:"true"); script_set_attribute(attribute:"metasploit_name", value:'PHP XML-RPC Arbitrary Code Execution'); script_set_attribute(attribute:"exploit_framework_metasploit", value:"true"); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:freebsd:freebsd:postnuke"); script_set_attribute(attribute:"cpe", value:"cpe:/o:freebsd:freebsd"); script_set_attribute(attribute:"vuln_publication_date", value:"2005/05/27"); script_set_attribute(attribute:"patch_publication_date", value:"2005/08/08"); script_set_attribute(attribute:"plugin_publication_date", value:"2006/05/13"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_copyright(english:"This script is Copyright (C) 2006-2019 and is owned by Tenable, Inc. or an Affiliate thereof."); script_family(english:"FreeBSD Local Security Checks"); script_dependencies("ssh_get_info.nasl"); script_require_keys("Host/local_checks_enabled", "Host/FreeBSD/release", "Host/FreeBSD/pkg_info"); exit(0); } include("audit.inc"); include("freebsd_package.inc"); if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED); if (!get_kb_item("Host/FreeBSD/release")) audit(AUDIT_OS_NOT, "FreeBSD"); if (!get_kb_item("Host/FreeBSD/pkg_info")) audit(AUDIT_PACKAGE_LIST_MISSING); flag = 0; if (pkg_test(save_report:TRUE, pkg:"postnuke<0.760")) flag++; if (flag) { if (report_verbosity > 0) security_hole(port:0, extra:pkg_report_get()); else security_hole(0); exit(0); } else audit(AUDIT_HOST_NOT, "affected");